What is the CVSS score of CVE-2026-57656?

CVE-2026-57656 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Hester Core CVE-2026-57656

EUVD-2026-39771 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-792x-cxvp-364w

WordPress XSS Wordpress Plugin

5.9

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

High privileges and user interaction required for injection; scope change confirmed; availability impact removed as XSS does not cause denial of service.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:09 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Hester Core WordPress plugin (versions ≤ 1.1.8) allows a high-privileged authenticated user to inject malicious JavaScript into author-related fields, which then executes in victims' browsers when they view affected content. The CVSS scope change (S:C) confirms the injected script escapes the originating context and impacts other users' sessions, potentially enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate widespread risk despite the cross-user impact.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) indicates the plugin fails to properly sanitize or encode user-controlled input before rendering it in HTML output. Hester Core is a WordPress companion plugin, likely paired with the Hester theme, and the XSS resides specifically in author-context data (e.g., author display name, bio, or meta fields editable by privileged users). The CVSS vector AV:N/S:C confirms the vulnerability is network-reachable and that the injected payload crosses security boundaries - executing in the browser context of users other than the attacker, consistent with persistent (stored) XSS behavior where unsanitized author data is persisted to the database and served to all site visitors.

RemediationAI

The primary remediation is to update the Hester Core WordPress plugin to a version beyond 1.1.8 - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hester-core/vulnerability/wordpress-hester-core-plugin-1-1-8-cross-site-scripting-xss-vulnerability for the confirmed fixed release version, as no exact patch version number was independently provided in the available intelligence data. If an immediate update is not feasible, compensating controls include restricting author-role account creation and auditing existing high-privilege accounts to reduce the population of potential injectors, as well as implementing a Content Security Policy (CSP) header that blocks inline script execution - note that CSP can break legitimate plugin JavaScript if not carefully tuned. Additionally, a web application firewall rule targeting XSS payloads in author fields can provide detection and blocking with low false-positive risk for this specific vector.